Qualys Discloses Linux CVE-2026-64600, Enabling Root on XFS Systems Since 4.11
Updated
Updated · The Hacker News · Jul 23
Qualys Discloses Linux CVE-2026-64600, Enabling Root on XFS Systems Since 4.11
3 articles · Updated · The Hacker News · Jul 23
Summary
Qualys said CVE-2026-64600 lets an unprivileged local user overwrite root-owned files on reflink-enabled XFS and gain persistent root, with its demo stripping the root password on a default RHEL 10.2 system.
Linux 4.11 and later are exposed when the target file and an attacker-writable directory share the same XFS filesystem and that filesystem was created with reflink=1; the race typically succeeded in under 10 seconds in testing.
The flaw stems from stale block mappings across an XFS lock cycle during copy-on-write, causing O_DIRECT writes aimed at an attacker's clone to land in the protected file while leaving ownership, timestamps and setuid metadata unchanged.
Red Hat began shipping backported fixes from July 14 across affected RHEL 8, 9 and 10 streams, and Debian has patched trixie-security and unstable, but no practical mitigation exists short of installing the fixed kernel and rebooting.
Default installs that can meet the exploit conditions include RHEL derivatives, Fedora Server 31+ and Amazon Linux 2023, while Debian, Ubuntu, SLES and openSUSE are generally affected only if admins chose reflink-enabled XFS manually.
As AI finds exploits in minutes, is our entire cybersecurity patching model now fundamentally broken?
If an AI-found exploit leaves no trace, how can anyone know if their system is already compromised?
With AI now writing its own kernel exploits, who is ultimately in control of cyber warfare?
CVE-2026-64600: AI Uncovers RefluXFS Vulnerability Impacting 16.4 Million Linux Systems
Overview
The RefluXFS vulnerability (CVE-2026-64600), disclosed on July 22, 2026, poses a major threat because it operates deep within the filesystem allocation layer, bypassing many standard security measures. Memory protections like KASLR, SMEP, and SMAP, as well as kernel lockdown features and SELinux, are ineffective against this flaw. Security experts and vendors responded urgently to assess the impact and provide guidance, as RefluXFS can evade both traditional defenses and container isolation techniques. This vulnerability highlights the need for immediate patching, since existing protections cannot stop attacks at such a fundamental system level.